Why shared EHR logins put physician practices at risk under HIPAA

Walk into many independent medical practices and you will find the same scene at the front desk. One computer stays signed in to the electronic health record all day. A sticky note on the monitor shows the username and password, in case it logs out. The receptionist, the medical assistant covering lunch, the float nurse and the student on rotation all use the same account.

It feels efficient. Check-in moves faster, nobody waits on a password reset and the morning schedule stays on track. For a physician owner, though, this is not a matter of IT preference. It is a business and liability problem, and it grows every day the shared login stays in place.

How a reused password travels

Shared passwords tend to get reused. The same password that opens the EHR often turns up on the practice’s email, a payer portal or a staff member’s personal shopping account.

That reuse is what attackers count on. In an attack called credential stuffing, criminals take usernames and passwords stolen in one data breach and use automated tools to try them on other sites. When a pair works, they get in with a valid login, and the sign-in looks routine.

So a practice’s security is only as strong as the weakest outside website where that password was also used. A breach at a retailer or ticketing site the practice has never dealt with can open the door to patient records.

What a shared login takes away

The bigger cost of a shared login appears after something goes wrong. EHR systems keep audit logs that record who opened a chart, when and what they did. Those logs are only useful if each account belongs to one person. When six people use one login, the log can show that “frontdesk” opened a chart at 2:14 p.m. It cannot show which of the six did it.

Federal rules already account for this. The HIPAA Security Rule requires covered entities to assign a unique name or number to identify and track each user, as set out in 45 CFR 164.312. The Department of Health and Human Services answers the question directly in an FAQ on shared log-on IDs. HHS says the rule does not permit a shared ID, regardless of the size of the practice, so that system access and activity can be traced to each workforce member.

The audit trail matters most during an incident. Under the HIPAA breach notification rule, 45 CFR 164.402, an impermissible use or disclosure is presumed to be a breach unless the practice can show a low probability that the information was compromised. A practice that can trace activity to one person can often narrow the scope to a handful of charts. A practice that cannot may have to treat every record the shared account touched as exposed.

A hypothetical practice

Consider a fictional family practice with two physicians, a nurse practitioner and five support staff. The front desk shares one login for the practice’s cloud-based EHR. Years earlier, a receptionist used that same password for an online pharmacy coupon site.

That site is breached, and the stolen passwords are sold. An attacker tries the receptionist’s email address and password on the EHR’s web portal, and it works. Over several evenings, the attacker browses patient demographics and insurance details.

When the practice notices the unusual activity, it calls its IT support team and its attorney. Both ask the same first question: Which charts did the attacker open, and which did staff open? The log shows a single account for all of it. The practice cannot separate the intruder’s activity from a month of normal check-ins, so its notification decisions must assume the worst.

What physician owners can do

None of the fixes requires a large budget, and most can be done in weeks.

Give every workforce member a unique login. That includes temporary staff, students, float staff and anyone covering a shift. If a person can open a chart, the system should know who they are.

Make individual sign-in fast. Badge-tap sign-in and fast user switching let staff move between accounts in seconds, so unique logins do not slow down the front desk.

Turn on automatic screen lock. Shared workstations in exam rooms and at check-in should lock after a short period of inactivity.

Use a password manager for outside portals. Payer, lab and clearinghouse portals often get shared informally. A password manager keeps those credentials out of sticky notes and spreadsheets and records who has access.

Require multifactor authentication on email and remote access. These are the most common entry points for attackers who already have a stolen password.

Screen for breached passwords. National Institute of Standards and Technology Special Publication 800-63B, the federal government’s digital identity guideline, calls for checking new passwords against lists of known compromised passwords. It also calls for forcing a change when there is evidence a password has been compromised, rather than on a fixed schedule.

Remove access the day someone leaves. Close accounts on a worker’s last day, and record the process in the practice’s HIPAA risk analysis so it is documented and repeatable.

What patients are trusting the practice to know

Patients share their health history on the assumption that the practice controls who sees it. Part of that promise is being able to answer a simple question: Who looked at my chart? A practice that relies on one shared login cannot answer it. A practice where every person signs in as themselves can, and that answer protects patients, staff and the practice itself.

Scott Carr is the owner of Farmhouse Networking, a managed IT services provider in Grants Pass, Oregon, that supports more than 80 businesses, including independent medical practices.